Skip to content
OpenAdvisories

Archive

13 February 2026

Vulnerabilities first published on this day (UTC), newest first.

← January 2026 2026 / February /13 March 2026 →
  1. 134
  2. 2158
  3. 3337
  4. 4253
  5. 5119
  6. 6204
  7. 762
  8. 875
  9. 9166
  10. 10282
  11. 11325
  12. 12128
  13. 1368
  14. 14163
  15. 1531
  16. 1688
  17. 17103
  18. 18239
  19. 19397
  20. 20380
  21. 2165
  22. 2259
  23. 2397
  24. 24225
  25. 25239
  26. 26174
  27. 27185
  28. 2818
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • High 7.2
    CVE-2026-1844 Public exploit

    PixelYourSite PRO <= 12.4.0.2 - Unauthenticated Stored Cross-Site Scripting

    The PixelYourSite PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pysTrafficSource' parameter and the 'pys_landing_page' parameter in all versions up to, and including, 12.4.0.2 due to insufficient input sanitization and output …

    PixelYourSite PixelYourSite Pro – Your smart PIXEL (TAG) Manager Web / CMS
  • Critical 9.3
    CVE-2026-26335 Public exploit

    Calero VeraSMART < 2022 R1 Static IIS Machine Keys Enable ViewState RCE

    Calero VeraSMART versions prior to 2022 R1 use static ASP.NET/IIS machineKey values configured for the VeraSMART web application and stored in C:\\Program Files (x86)\\Veramark\\VeraSMART\\WebRoot\\web.config. An attacker who obtains these keys can craft a va…

    Calero VeraSMART
  • Critical 9.8
    CVE-2026-26190 Public exploit Scanner template EPSS 39%

    Milvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise

    Milvus is an open-source vector database built for generative AI applications. Prior to 2.5.27 and 2.6.10, Milvus exposes TCP port 9091 by default, which enables authentication bypasses. The /expr debug endpoint uses a weak, predictable default authentication…

    milvus-io milvus github.com/milvus-io/milvus Go
  • High 7.7
    CVE-2026-25991 Public exploit

    Tandoor Recipes affected by Blind SSRF with Internal Network Access via Recipe Import

    Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, there is a Blind Server-Side Request Forgery (SSRF) vulnerability in the Cookmate recipe import feature of Tandoor Recipes. The application fa…

    Tandoor Recipes recipes
  • High 8.8
    CVE-2026-2441 Exploited Public exploit EPSS 54%

    Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code insid…

    Google Chrome chromium chromium Browsers Debian Alpine Wolfi
    KEV Feb 17, 2026
  • Medium 4.9
    CVE-2026-25964 Public exploit

    Tandoor Recipes Affected by Authenticated Local File Disclosure (LFD) via Recipe Import leads to Arbitrary File Read

    Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, a Path Traversal vulnerability in the RecipeImport workflow of Tandoor Recipes allows authenticated users with import permissions to read arbi…

    Tandoor Recipes recipes
  • High 8.1
    CVE-2026-26268 Public exploit

    Cursor sandbox escape via Git hooks

    Cursor is a code editor built for programming with AI. Sandbox escape via writing .git configuration was possible in versions prior to 2.5. A malicious agent (ie prompt injection) could write to improperly protected .git settings, including git hooks, which m…

    cursor cursor
  • Critical 9.8
    CVE-2026-26221 Public exploit

    Hyland OnBase Timer Service Unauthenticated .NET Remoting RCE

    Hyland OnBase contains an unauthenticated .NET Remoting exposure in the OnBase Workflow Timer Service (Hyland.Core.Workflow.NTService.exe). An attacker who can reach the service can send crafted .NET Remoting requests to default HTTP channel endpoints on TCP/…

    Hyland OnBase Workflow Timer Service
  • High 7.8
    CVE-2026-23111 Public exploit

    netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() nft_map_catchall_activate() has an inverted element activity check compared to its non-catchall counterpart nft…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 6.2
    CVE-2025-66676 Public exploit

    An issue in IObit Unlocker v1.3.0.11 allows attackers to cause a Denial of Service (DoS) via a crafted request.